msw/CISS.debian.live.builder
SHA256
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

V8.13.392.2025.11.07
Some checks failed
🛡️ Retrieve DNSSEC status of coresecret.dev. / 🛡️ Retrieve DNSSEC status of coresecret.dev. (push) Successful in 1m5s
Details
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m15s
Details
🔐 Generating a Private Live ISO TRIXIE. / 🔐 Generating a Private Live ISO TRIXIE. (push) Failing after 1m23s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-11-07 17:12:52 +01:00
parent 4e5bc1aa84
commit 051361abbb
79 changed files with 359 additions and 160 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.archive/.0000_lib_usage.sh
View File

@@ -21,7 +21,7 @@ usage() {
clear clear
cat << EOF cat << EOF
$(echo -e "\e[92mCISS.debian.live.builder\e[0m") $(echo -e "\e[92mCISS.debian.live.builder\e[0m")
$(echo -e "\e[92mMaster V8.13.384.2025.11.06\e[0m") $(echo -e "\e[92mMaster V8.13.392.2025.11.07\e[0m")
$(echo -e "\e[92mA lightweight Shell Wrapper for building a hardened Debian Live ISO Image.\e[0m") $(echo -e "\e[92mA lightweight Shell Wrapper for building a hardened Debian Live ISO Image.\e[0m")
$(echo -e "\e[97m(c) Marc S. Weidner, 2018 - 2025\e[0m") $(echo -e "\e[97m(c) Marc S. Weidner, 2018 - 2025\e[0m")

2
.archive/generate_PRIVATE_trixie_0.yaml
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
# Version Master V8.13.384.2025.11.06 # Version Master V8.13.392.2025.11.07
name: 🔐 Generating a Private Live ISO TRIXIE. name: 🔐 Generating a Private Live ISO TRIXIE.

2
.archive/generate_PRIVATE_trixie_1.yaml
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
# Version Master V8.13.384.2025.11.06 # Version Master V8.13.392.2025.11.07
name: 🔐 Generating a Private Live ISO TRIXIE. name: 🔐 Generating a Private Live ISO TRIXIE.

2
.archive/generate_PUBLIC_iso.yaml
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
# Version Master V8.13.384.2025.11.06 # Version Master V8.13.392.2025.11.07
name: 💙 Generating a PUBLIC Live ISO. name: 💙 Generating a PUBLIC Live ISO.

2
.archive/lib_lb_config_write.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Wrapper to write a new 'lb config' environment. # Wrapper to write a new 'lb config' environment.

2
.gitea/ISSUE_TEMPLATE/ISSUE_TEMPLATE.yaml
View File

@@ -25,7 +25,7 @@ body:
attributes: attributes:
label: "Version" label: "Version"
description: "Which version are you running? Use `./ciss_live_builder.sh -v`." description: "Which version are you running? Use `./ciss_live_builder.sh -v`."
placeholder: "e.g., Master V8.13.384.2025.11.06" placeholder: "e.g., Master V8.13.392.2025.11.07"
validations: validations:
required: true required: true

2
.gitea/TODO/dockerfile
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
# Version Master V8.13.384.2025.11.06 # Version Master V8.13.392.2025.11.07
FROM debian:bookworm FROM debian:bookworm

2
.gitea/TODO/render-md-to-html.yaml
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
# Version Master V8.13.384.2025.11.06 # Version Master V8.13.392.2025.11.07
name: 🔁 Render README.md to README.html. name: 🔁 Render README.md to README.html.

2
.gitea/trigger/t_generate_PRIVATE_trixie_1.yaml
View File

@@ -11,5 +11,5 @@
build: build:
counter: 1023 counter: 1023
version: V8.13.384.2025.11.06 version: V8.13.392.2025.11.07
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml

2
.gitea/trigger/t_generate_dns.yaml
View File

@@ -11,5 +11,5 @@
build: build:
counter: 1023 counter: 1023
version: V8.13.384.2025.11.06 version: V8.13.392.2025.11.07
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml

2
.gitea/workflows/generate_PRIVATE_trixie_1.yaml
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
# Version Master V8.13.384.2025.11.06 # Version Master V8.13.392.2025.11.07
name: 🔐 Generating a Private Live ISO TRIXIE. name: 🔐 Generating a Private Live ISO TRIXIE.

2
.gitea/workflows/linter_char_scripts.yaml
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
# Version Master V8.13.384.2025.11.06 # Version Master V8.13.392.2025.11.07
# Gitea Workflow: Shell-Script Linting # Gitea Workflow: Shell-Script Linting
# #

2
.gitea/workflows/render-dnssec-status.yaml
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
# Version Master V8.13.384.2025.11.06 # Version Master V8.13.392.2025.11.07
name: 🛡️ Retrieve DNSSEC status of coresecret.dev. name: 🛡️ Retrieve DNSSEC status of coresecret.dev.

2
.gitea/workflows/render-dot-to-png.yaml
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
# Version Master V8.13.384.2025.11.06 # Version Master V8.13.392.2025.11.07
name: 🔁 Render Graphviz Diagrams. name: 🔁 Render Graphviz Diagrams.

2
.version.properties
View File

@@ -15,5 +15,5 @@ properties_SPDX-License-Identifier="EUPL-1.2 OR LicenseRef-CCLA-1.0"
properties_SPDX-LicenseComment="This file is part of the CISS.debian.installer.secure framework." properties_SPDX-LicenseComment="This file is part of the CISS.debian.installer.secure framework."
properties_SPDX-PackageName="CISS.debian.live.builder" properties_SPDX-PackageName="CISS.debian.live.builder"
properties_SPDX-Security-Contact="security@coresecret.eu" properties_SPDX-Security-Contact="security@coresecret.eu"
properties_version="V8.13.384.2025.11.06" properties_version="V8.13.392.2025.11.07"
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf

2
CISS.debian.live.builder.spdx
View File

@@ -6,7 +6,7 @@ Creator: Person: Marc S. Weidner (Centurion Intelligence Consulting Agency)
Created: 2025-05-07T12:00:00Z Created: 2025-05-07T12:00:00Z
Package: CISS.debian.live.builder Package: CISS.debian.live.builder
PackageName: CISS.debian.live.builder PackageName: CISS.debian.live.builder
PackageVersion: Master V8.13.384.2025.11.06 PackageVersion: Master V8.13.392.2025.11.07
PackageSupplier: Organization: Centurion Intelligence Consulting Agency PackageSupplier: Organization: Centurion Intelligence Consulting Agency
PackageDownloadLocation: https://git.coresecret.dev/msw/CISS.debian.live.builder PackageDownloadLocation: https://git.coresecret.dev/msw/CISS.debian.live.builder
PackageHomePage: https://git.coresecret.dev/msw/CISS.debian.live.builder PackageHomePage: https://git.coresecret.dev/msw/CISS.debian.live.builder

6
README.md
View File

@@ -2,7 +2,7 @@
gitea: none gitea: none
include_toc: true include_toc: true
--- ---
[![Static Badge](https://badges.coresecret.dev/badge/Release-V8.13.384.2025.11.06-white?style=plastic&logo=linux&logoColor=white&logoSize=auto&label=Release&color=%23FCC624)](https://git.coresecret.dev/msw/CISS.debian.live.builder) [![Static Badge](https://badges.coresecret.dev/badge/Release-V8.13.392.2025.11.07-white?style=plastic&logo=linux&logoColor=white&logoSize=auto&label=Release&color=%23FCC624)](https://git.coresecret.dev/msw/CISS.debian.live.builder)
&nbsp; &nbsp;
[![Static Badge](https://badges.coresecret.dev/badge/Licence-EUPL1.2-white?style=plastic&logo=europeanunion&logoColor=white&logoSize=auto&label=Licence&color=%23003399)](https://eupl.eu/1.2/en/) &nbsp; [![Static Badge](https://badges.coresecret.dev/badge/Licence-EUPL1.2-white?style=plastic&logo=europeanunion&logoColor=white&logoSize=auto&label=Licence&color=%23003399)](https://eupl.eu/1.2/en/) &nbsp;
[![Static Badge](https://badges.coresecret.dev/badge/opensourceinitiative-Compliant-white?style=plastic&logo=opensourceinitiative&logoColor=white&logoSize=auto&label=OSI&color=%233DA639)](https://opensource.org/license/eupl-1-2) &nbsp; [![Static Badge](https://badges.coresecret.dev/badge/opensourceinitiative-Compliant-white?style=plastic&logo=opensourceinitiative&logoColor=white&logoSize=auto&label=OSI&color=%233DA639)](https://opensource.org/license/eupl-1-2) &nbsp;
@@ -27,7 +27,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.13<br> **Master Version**: 8.13<br>
**Build**: V8.13.384.2025.11.06<br> **Build**: V8.13.392.2025.11.07<br>
This shell wrapper automates the creation of a Debian Bookworm live ISO hardened according to the latest best practices in server This shell wrapper automates the creation of a Debian Bookworm live ISO hardened according to the latest best practices in server
and service security. It integrates into your build pipeline to deliver an isolated, robust environment suitable for and service security. It integrates into your build pipeline to deliver an isolated, robust environment suitable for
@@ -152,7 +152,7 @@ This means function status of the **CISS.2025.debian.live.builder** ISO after d-
This project adheres strictly to a structured versioning scheme following the pattern x.y.z-Date. This project adheres strictly to a structured versioning scheme following the pattern x.y.z-Date.
Example: `V8.13.384.2025.11.06` Example: `V8.13.392.2025.11.07`
`x.y.z` represents major (x), minor (y), and patch (z) version increments. `x.y.z` represents major (x), minor (y), and patch (z) version increments.

4
REPOSITORY.md
View File

@@ -8,13 +8,13 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.13<br> **Master Version**: 8.13<br>
**Build**: V8.13.384.2025.11.06<br> **Build**: V8.13.392.2025.11.07<br>
# 2.1. Repository Structure # 2.1. Repository Structure
**Project:** Centurion Intelligence Consulting Agency Information Security Standard (CISS) — Debian Live Builder **Project:** Centurion Intelligence Consulting Agency Information Security Standard (CISS) — Debian Live Builder
**Branch:** `master` **Branch:** `master`
**Repository State:** Master Version **8.13**, Build **V8.13.384.2025.11.06** (as of 2025-10-11) **Repository State:** Master Version **8.13**, Build **V8.13.392.2025.11.07** (as of 2025-10-11)
## 2.2. Top-Level Layout ## 2.2. Top-Level Layout

11
ciss_live_builder.sh
View File

@@ -102,6 +102,9 @@ for arg in "$@"; do case "${arg,,}" in -h|--help) . ./lib/lib_usage.sh ;
for arg in "$@"; do case "${arg,,}" in -v|--version) . ./lib/lib_version.sh ; version; exit 0;; esac; done for arg in "$@"; do case "${arg,,}" in -v|--version) . ./lib/lib_version.sh ; version; exit 0;; esac; done
for arg in "$@"; do case "${arg,,}" in -d|--debug) . ./meta_sources_debug.sh; debugger "${@}";; esac; done for arg in "$@"; do case "${arg,,}" in -d|--debug) . ./meta_sources_debug.sh; debugger "${@}";; esac; done
### CHECKING REQUIRED PACKAGES.
check_pkgs
### ALL CHECKS DONE. READY TO START THE SCRIPT. ### ALL CHECKS DONE. READY TO START THE SCRIPT.
find "${VAR_TMP_SECRET}" -type f -exec chmod 0400 {} + find "${VAR_TMP_SECRET}" -type f -exec chmod 0400 {} +
declare -grx VAR_SETUP="true" declare -grx VAR_SETUP="true"
@@ -166,22 +169,16 @@ fi
for arg in "$@"; do case "${arg,,}" in -a=*|--autobuild=*) declare -gx VAR_HANDLER_AUTOBUILD="true"; declare -gx VAR_KERNEL="${arg#*=}";; esac; done; unset arg for arg in "$@"; do case "${arg,,}" in -a=*|--autobuild=*) declare -gx VAR_HANDLER_AUTOBUILD="true"; declare -gx VAR_KERNEL="${arg#*=}";; esac; done; unset arg
for dir in /usr/local/sbin /usr/sbin; do case ":${PATH}:" in *":${dir}:"*) ;; *) PATH="${PATH}:${dir}" ;; esac; done; export PATH; unset dir for dir in /usr/local/sbin /usr/sbin; do case ":${PATH}:" in *":${dir}:"*) ;; *) PATH="${PATH}:${dir}" ;; esac; done; export PATH; unset dir
### CHECKING REQUIRED PACKAGES.
check_pkgs
### DIALOG OUTPUT FOR INITIALIZATION. ### DIALOG OUTPUT FOR INITIALIZATION.
if ! ${VAR_HANDLER_AUTOBUILD}; then boot_screen; fi if ! ${VAR_HANDLER_AUTOBUILD}; then boot_screen; fi
### Updating Status of Dialog Gauge Bar. ### Updating Status of Dialog Gauge Bar.
if ! ${VAR_HANDLER_AUTOBUILD}; then printf "XXX\nInitialization done ... \nXXX\n15\n" >&3; fi if ! ${VAR_HANDLER_AUTOBUILD}; then printf "XXX\nInitialization done ... \nXXX\n15\n" >&3; fi
### Updating Status of Dialog Gauge Bar.
if ! ${VAR_HANDLER_AUTOBUILD}; then printf "XXX\nAdditional initialization ... \nXXX\n30\n" >&3; fi
### Updating Status of Dialog Gauge Bar. ### Updating Status of Dialog Gauge Bar.
if ! ${VAR_HANDLER_AUTOBUILD}; then printf "XXX\nActivate traps ... \nXXX\n50\n" >&3; fi if ! ${VAR_HANDLER_AUTOBUILD}; then printf "XXX\nActivate traps ... \nXXX\n50\n" >&3; fi
### Following the CISS Bash naming and ordering scheme: ### Following the CISS Bash naming and ordering scheme:
trap 'trap_on_exit "$?"' EXIT trap 'trap_on_exit "$?" "${BASH_SOURCE[0]}" "${LINENO}" "${FUNCNAME[0]:-main}" "${BASH_COMMAND}"' EXIT
trap 'trap_on_err "$?" "${BASH_SOURCE[0]}" "${LINENO}" "${FUNCNAME[0]:-main}" "${BASH_COMMAND}"' ERR trap 'trap_on_err "$?" "${BASH_SOURCE[0]}" "${LINENO}" "${FUNCNAME[0]:-main}" "${BASH_COMMAND}"' ERR
### Updating Status of Dialog Gauge Bar. ### Updating Status of Dialog Gauge Bar.

2
config/includes.chroot/etc/ssh/ssh_known_hosts
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
# Version Master V8.13.384.2025.11.06 # Version Master V8.13.392.2025.11.07
[git.coresecret.dev]:42842 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGQA107AVmg1D/jnyXiqbPf38zQRl8s3c+PM1zbfpeQl [git.coresecret.dev]:42842 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGQA107AVmg1D/jnyXiqbPf38zQRl8s3c+PM1zbfpeQl
[git.coresecret.dev]:42842 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDYD9ysmMWZlejUnxu0qOzeWcIYezoFLbYdo6ffGUL5kqOBAYb+5CF4bJLUpA93XFYVF+TbrcMV1yJh6JaHFL0VU5CvgAzruCeedx0c4qUV6lWcJUGNk5K0yb9n2Wosdy6F/zTOxL9KXBt/TV+cscsen2Dahvx0ctMKgNbu+vvUcWxHf9lOkbYoF/uA/nW5CVXy5XUPVUDFUhEeKXL85+6gid5AEMfYT8aRl5YDGvo1iMBmBYOljN4S7MnRe14qbAZG0GDGvF22eHbSU2pILcFIjc2Lo/S5Ox/MJpbLAqpFlLPTKgr6F7yVwfNMSNwl05ysUOZfrQKSXzCU6+lfqKYCwemLALyG/n1ernpp7/8W/2RYoz3fd+TQyfhW++rx3yUHpYCkTv9A4LRYZYGSAWKMHSBEYq3EcATQUxQi0xpwmcR+u0uC9F9eta5Bim+sBZD6F2hgPJ5xgYT8LFm880g1YadAwBoD4TAkqSvl+jYW0VA2GH9CknKHJ36gc/X4eeUHDC1Hf/E8M5RBj4D6NuHfeVRik/ahHmoCqKQUW7VU/EBsWFsngDiLEHcV71iMtWiUddWOHwoAPHIzn6p9HTeLCxTwsPMG5UDGK/S9HUozqDXxexRtqbcFa7DWuzRvZ1bcZ2VQsaafuzKCkkc4NjC7h1wssel7q9aeYPFg+1vS6Q== [git.coresecret.dev]:42842 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDYD9ysmMWZlejUnxu0qOzeWcIYezoFLbYdo6ffGUL5kqOBAYb+5CF4bJLUpA93XFYVF+TbrcMV1yJh6JaHFL0VU5CvgAzruCeedx0c4qUV6lWcJUGNk5K0yb9n2Wosdy6F/zTOxL9KXBt/TV+cscsen2Dahvx0ctMKgNbu+vvUcWxHf9lOkbYoF/uA/nW5CVXy5XUPVUDFUhEeKXL85+6gid5AEMfYT8aRl5YDGvo1iMBmBYOljN4S7MnRe14qbAZG0GDGvF22eHbSU2pILcFIjc2Lo/S5Ox/MJpbLAqpFlLPTKgr6F7yVwfNMSNwl05ysUOZfrQKSXzCU6+lfqKYCwemLALyG/n1ernpp7/8W/2RYoz3fd+TQyfhW++rx3yUHpYCkTv9A4LRYZYGSAWKMHSBEYq3EcATQUxQi0xpwmcR+u0uC9F9eta5Bim+sBZD6F2hgPJ5xgYT8LFm880g1YadAwBoD4TAkqSvl+jYW0VA2GH9CknKHJ36gc/X4eeUHDC1Hf/E8M5RBj4D6NuHfeVRik/ahHmoCqKQUW7VU/EBsWFsngDiLEHcV71iMtWiUddWOHwoAPHIzn6p9HTeLCxTwsPMG5UDGK/S9HUozqDXxexRtqbcFa7DWuzRvZ1bcZ2VQsaafuzKCkkc4NjC7h1wssel7q9aeYPFg+1vS6Q==

2
config/includes.chroot/etc/ssh/sshd_config
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
# Version Master V8.13.384.2025.11.06 # Version Master V8.13.392.2025.11.07
### https://www.ssh-audit.com/ ### https://www.ssh-audit.com/
### ssh -Q cipher | cipher-auth | compression | kex | kex-gss | key | key-cert | key-plain | key-sig | mac | protocol-version | sig ### ssh -Q cipher | cipher-auth | compression | kex | kex-gss | key | key-cert | key-plain | key-sig | mac | protocol-version | sig

2
config/includes.chroot/etc/sysctl.d/99_local.hardened
View File

@@ -11,7 +11,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
# Version Master V8.13.384.2025.11.06 # Version Master V8.13.392.2025.11.07
### https://docs.kernel.org/ ### https://docs.kernel.org/
### https://github.com/a13xp0p0v/kernel-hardening-checker/ ### https://github.com/a13xp0p0v/kernel-hardening-checker/

2
config/includes.chroot/preseed/.iso/preseed_hash_generator.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
declare -gr VERSION="Master V8.13.384.2025.11.06" declare -gr VERSION="Master V8.13.392.2025.11.07"
### VERY EARLY CHECK FOR DEBUGGING ### VERY EARLY CHECK FOR DEBUGGING
if [[ $* == *" --debug "* ]]; then if [[ $* == *" --debug "* ]]; then

2
config/includes.chroot/preseed/preseed.cfg
View File

@@ -112,4 +112,4 @@ d-i preseed/late_command string sh /preseed/.ash/3_di_preseed_late_command.sh
# Please consider donating to my work at: https://coresecret.eu/spenden/ # Please consider donating to my work at: https://coresecret.eu/spenden/
########################################################################################### ###########################################################################################
# Written by: ./preseed_hash_generator.sh Version: Master V8.13.384.2025.11.06 at: 10:18:37.9542 # Written by: ./preseed_hash_generator.sh Version: Master V8.13.392.2025.11.07 at: 10:18:37.9542

2
docs/AUDIT_DNSSEC.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.13<br> **Master Version**: 8.13<br>
**Build**: V8.13.384.2025.11.06<br> **Build**: V8.13.392.2025.11.07<br>
# 2. DNSSEC Status # 2. DNSSEC Status

2
docs/AUDIT_HAVEGED.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.13<br> **Master Version**: 8.13<br>
**Build**: V8.13.384.2025.11.06<br> **Build**: V8.13.392.2025.11.07<br>
# 2. Haveged Audit on Netcup RS 2000 G11 # 2. Haveged Audit on Netcup RS 2000 G11

2
docs/AUDIT_LYNIS.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.13<br> **Master Version**: 8.13<br>
**Build**: V8.13.384.2025.11.06<br> **Build**: V8.13.392.2025.11.07<br>
# 2. Lynis Audit: # 2. Lynis Audit:

2
docs/AUDIT_SSH.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.13<br> **Master Version**: 8.13<br>
**Build**: V8.13.384.2025.11.06<br> **Build**: V8.13.392.2025.11.07<br>
# 2. SSH Audit by ssh-audit.com # 2. SSH Audit by ssh-audit.com

2
docs/AUDIT_TLS.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.13<br> **Master Version**: 8.13<br>
**Build**: V8.13.384.2025.11.06<br> **Build**: V8.13.392.2025.11.07<br>
# 2. TLS Audit: # 2. TLS Audit:
````text ````text

2
docs/BOOTPARAMS.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.13<br> **Master Version**: 8.13<br>
**Build**: V8.13.384.2025.11.06<br> **Build**: V8.13.392.2025.11.07<br>
# 2. Hardened Kernel Boot Parameters # 2. Hardened Kernel Boot Parameters

9
docs/CHANGELOG.md
View File

@@ -8,12 +8,17 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.13<br> **Master Version**: 8.13<br>
**Build**: V8.13.384.2025.11.06<br> **Build**: V8.13.392.2025.11.07<br>
# 2. Changelog # 2. Changelog
## V8.13.384.2025.11.06 ## V8.13.392.2025.11.07
* **Global**: Changed ``guard_sourcing`` to ``guard_sourcing || return "${ERR_GUARD_SRCE}"``
* **Added**: [lib_trap_on_err.sh](../lib/lib_trap_on_err.sh) + ``print_stacktrace`()
* **Added**: [lib_trap_on_exit.sh](../lib/lib_trap_on_exit.sh) + Trap on ``EXIT`` handler for 'non-0' exit-code.
* **Bugfixes**: [lib_gnupg.sh](../lib/lib_gnupg.sh) + modified passphrase handling
## V8.13.384.2025.11.06
* **Global**: Changed ``shred -vfzu -n 5`` to ``shred -fzu -n 5``. * **Global**: Changed ``shred -vfzu -n 5`` to ``shred -fzu -n 5``.
* **Global**: Live-hooks: ``apt-get`` commands safeguarded by ``export DEBIAN_FRONTEND="noninteractive" INITRD="No"``. * **Global**: Live-hooks: ``apt-get`` commands safeguarded by ``export DEBIAN_FRONTEND="noninteractive" INITRD="No"``.
* **Added**: [marc_s_weidner_msw+deploy@coresecet.dev_0x2CCF4601_public.asc](../.pubkey/marc_s_weidner_msw%2Bdeploy%40coresecet.dev_0x2CCF4601_public.asc) * **Added**: [marc_s_weidner_msw+deploy@coresecet.dev_0x2CCF4601_public.asc](../.pubkey/marc_s_weidner_msw%2Bdeploy%40coresecet.dev_0x2CCF4601_public.asc)

2
docs/CNET.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.13<br> **Master Version**: 8.13<br>
**Build**: V8.13.384.2025.11.06<br> **Build**: V8.13.392.2025.11.07<br>
# 2. Centurion Net - Developer Branch Overview # 2. Centurion Net - Developer Branch Overview

2
docs/CODING_CONVENTION.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.13<br> **Master Version**: 8.13<br>
**Build**: V8.13.384.2025.11.06<br> **Build**: V8.13.392.2025.11.07<br>
# 2. Coding Style # 2. Coding Style

2
docs/CONTRIBUTING.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.13<br> **Master Version**: 8.13<br>
**Build**: V8.13.384.2025.11.06<br> **Build**: V8.13.392.2025.11.07<br>
# 2. Contributing / participating # 2. Contributing / participating

2
docs/CREDITS.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.13<br> **Master Version**: 8.13<br>
**Build**: V8.13.384.2025.11.06<br> **Build**: V8.13.392.2025.11.07<br>
# 2. Credits # 2. Credits

2
docs/DL_PUB_ISO.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.13<br> **Master Version**: 8.13<br>
**Build**: V8.13.384.2025.11.06<br> **Build**: V8.13.392.2025.11.07<br>
# 2. Download the latest PUBLIC CISS.debian.live.ISO # 2. Download the latest PUBLIC CISS.debian.live.ISO

6
docs/DOCUMENTATION.md
View File

@@ -8,14 +8,14 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.13<br> **Master Version**: 8.13<br>
**Build**: V8.13.384.2025.11.06<br> **Build**: V8.13.392.2025.11.07<br>
# 2.1. Usage # 2.1. Usage
````text ````text
CDLB(1) CISS.debian.live.builder CDLB(1) CDLB(1) CISS.debian.live.builder CDLB(1)
CISS.debian.live.builder from https://git.coresecret.dev/msw CISS.debian.live.builder from https://git.coresecret.dev/msw
Master V8.13.384.2025.11.06 Master V8.13.392.2025.11.07
A lightweight Shell Wrapper for building a hardened Debian Live ISO Image. A lightweight Shell Wrapper for building a hardened Debian Live ISO Image.
(c) Marc S. Weidner, 2018 - 2025 (c) Marc S. Weidner, 2018 - 2025
@@ -145,7 +145,7 @@ A lightweight Shell Wrapper for building a hardened Debian Live ISO Image.
💷 Please consider donating to my work at: 💷 Please consider donating to my work at:
🌐 https://coresecret.eu/spenden/ 🌐 https://coresecret.eu/spenden/
V8.13.384.2025.11.06 2025-11-06 CDLB(1) V8.13.392.2025.11.07 2025-11-06 CDLB(1)
```` ````
# 3. Booting # 3. Booting

2
docs/REFERENCES.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.13<br> **Master Version**: 8.13<br>
**Build**: V8.13.384.2025.11.06<br> **Build**: V8.13.392.2025.11.07<br>
# 2. Resources # 2. Resources

2
lib/lib_arg_parser.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Argument Parser. # Argument Parser.

2
lib/lib_arg_priority_check.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Check and setup Script Priorities # Check and setup Script Priorities

2
lib/lib_boot_screen.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Set up a gauge Dialog Wrapper. # Set up a gauge Dialog Wrapper.

2
lib/lib_cdi.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# CISS.debian.installer 'GRUB' and 'autostart' generator. # CISS.debian.installer 'GRUB' and 'autostart' generator.

2
lib/lib_change_splash.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Change Grub Boot Screen Splash # Change Grub Boot Screen Splash

2
lib/lib_check_dhcp.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Check if hardened Centurion DNS servers are desired. # Check if hardened Centurion DNS servers are desired.

2
lib/lib_check_hooks.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Check and apply 0755 Permissions on every '"${VAR_HANDLER_BUILD_DIR}"/./config/hooks/live/*.chroot'-file. # Check and apply 0755 Permissions on every '"${VAR_HANDLER_BUILD_DIR}"/./config/hooks/live/*.chroot'-file.

2
lib/lib_check_kernel.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Kernel Image Selector # Kernel Image Selector

12
lib/lib_check_pkgs.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Check for required Deb Packages to run the script. # Check for required Deb Packages to run the script.
@@ -43,20 +43,10 @@ check_pkgs() {
if ! command -v debootstrap >/dev/null 2>&1; then if ! command -v debootstrap >/dev/null 2>&1; then
if grep -RqsE '^[[:space:]]*deb .*backports' /etc/apt/sources.list /etc/apt/sources.list.d; then
# shellcheck disable=SC2155
declare codename=$(lsb_release -sc)
apt-get install -y -t "${codename}-backports" debootstrap
else
apt-get install -y debootstrap apt-get install -y debootstrap
fi fi
fi
if [[ ! -f /usr/share/live/build/VERSION ]]; then if [[ ! -f /usr/share/live/build/VERSION ]]; then
apt-get install -y live-build apt-get install -y live-build

2
lib/lib_check_provider.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Notes Textbox. # Notes Textbox.

2
lib/lib_check_stats.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Check if analysis run is desired only. # Check if analysis run is desired only.

2
lib/lib_check_var.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Unbound variable check and call trap on 'ERR'. # Unbound variable check and call trap on 'ERR'.

2
lib/lib_ciss_upgrades_boot.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Integrates primordial SSH identity- and / or ssh_host-files. # Integrates primordial SSH identity- and / or ssh_host-files.

2
lib/lib_ciss_upgrades_build.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Module to update '/usr/lib/live/build/...' scripts. # Module to update '/usr/lib/live/build/...' scripts.

2
lib/lib_clean_screen.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Terminal cleaner before Trap on Error # Terminal cleaner before Trap on Error

2
lib/lib_clean_up.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Cleanup wrapper on the traps on 'ERR' and 'EXIT'. # Cleanup wrapper on the traps on 'ERR' and 'EXIT'.

2
lib/lib_copy_integrity.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Copy Initial ISO aide Database into Host System # Copy Initial ISO aide Database into Host System

2
lib/lib_debug.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Debugger module for xtrace to debug log. # Debugger module for xtrace to debug log.

2
lib/lib_debug_header.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Generates the debug log header. # Generates the debug log header.

41
lib/lib_gnupg.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Init GNUPGHOME. # Init GNUPGHOME.
@@ -51,8 +51,20 @@ init_gnupg() {
# shellcheck disable=SC2174 # shellcheck disable=SC2174
mkdir -p -m 0700 "${GNUPGHOME}" mkdir -p -m 0700 "${GNUPGHOME}"
echo 'allow-loopback-pinentry' >| "${GNUPGHOME}/gpg-agent.conf" cat << EOF >> "${GNUPGHOME}/gpg-agent.conf"
gpgconf --reload gpg-agent || true allow-loopback-pinentry
pinentry-program /usr/bin/pinentry-tty
EOF
gpgconf --kill gpg-agent || true
if ! gpgconf --launch gpg-agent >/dev/null 2>&1; then
printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ Failed to launch gpg-agent. \e[0m\n"
umask "${__umask}"
return "${ERR_GPG__AGENT}"
fi
else else
@@ -60,14 +72,11 @@ init_gnupg() {
fi fi
gpg --batch --import "${VAR_TMP_SECRET}/${VAR_SIGNING_KEY}" ### Use pubring as verification keyring reference.
shred -fzu -n 5 -- "${VAR_TMP_SECRET}/${VAR_SIGNING_KEY}"
gpg --batch --export "${VAR_SIGNING_KEY_FPR}" >| "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/etc/ciss/keys/${VAR_SIGNING_KEY_FPR}_public.gpg"
gpg --batch --export "${VAR_SIGNING_KEY_FPR}" >| "${VAR_HANDLER_BUILD_DIR}/config/includes.binary/0030-verify-checksums_public.gpg"
declare -grx VAR_VERIFY_KEYRING="${GNUPGHOME}/pubring.kbx" declare -grx VAR_VERIFY_KEYRING="${GNUPGHOME}/pubring.kbx"
declare -grx VAR_SIGNING_KEY_PASSFILE="${VAR_TMP_SECRET}/${VAR_SIGNING_KEY_PASS}" declare -grx VAR_SIGNING_KEY_PASSFILE="${VAR_TMP_SECRET}/${VAR_SIGNING_KEY_PASS}"
### No tracing for security reasons ------------------------------------------------------------------------------------------ ### No tracing for security reasons ------------------------------------------------------------------------------------------
[[ "${VAR_EARLY_DEBUG}" == "true" ]] && set +x [[ "${VAR_EARLY_DEBUG}" == "true" ]] && set +x
@@ -78,6 +87,20 @@ init_gnupg() {
### Turn on tracing again ---------------------------------------------------------------------------------------------------- ### Turn on tracing again ----------------------------------------------------------------------------------------------------
[[ "${VAR_EARLY_DEBUG}" == "true" ]] && set -x [[ "${VAR_EARLY_DEBUG}" == "true" ]] && set -x
if ! gpg --batch --yes --pinentry-mode=loopback --passphrase-file "${VAR_SIGNING_KEY_PASSFILE}" --import "${VAR_TMP_SECRET}/${VAR_SIGNING_KEY}"; then
printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ Failed to import signing key. \e[0m\n"
umask "${__umask}"
return "${ERR_GPG__AGENT}"
fi
shred -fzu -n 5 -- "${VAR_TMP_SECRET}/${VAR_SIGNING_KEY}"
### Export public key for verification inside ISO / chroot.
gpg --batch --yes --export "${VAR_SIGNING_KEY_FPR}" >| "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/etc/ciss/keys/${VAR_SIGNING_KEY_FPR}_public.gpg"
gpg --batch --yes --export "${VAR_SIGNING_KEY_FPR}" >| "${VAR_HANDLER_BUILD_DIR}/config/includes.binary/0030-verify-checksums_public.gpg"
umask "${__umask}" umask "${__umask}"
__umask="" __umask=""

2
lib/lib_hardening_root_pw.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Updates the Live ISO to use root password authentication for local console access. # Updates the Live ISO to use root password authentication for local console access.

2
lib/lib_hardening_ssh_tcp.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# SSH hardening via TCP wrapper. # SSH hardening via TCP wrapper.

2
lib/lib_hardening_ultra.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Module for accompanying all 'CISS.debian.hardening' features into the Live ISO image. # Module for accompanying all 'CISS.debian.hardening' features into the Live ISO image.

2
lib/lib_helper_ip.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# IP notation cleaner for pure IP output only. # IP notation cleaner for pure IP output only.

2
lib/lib_lb_build_start.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Wrapper to write a new 'lb config' environment. # Wrapper to write a new 'lb config' environment.

2
lib/lib_lb_config_start.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Wrapper for 'lb config' - set up a build environment or deleting old build artifacts. # Wrapper for 'lb config' - set up a build environment or deleting old build artifacts.

2
lib/lib_lb_config_write_trixie.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Wrapper to write a new 'lb config' environment. # Wrapper to write a new 'lb config' environment.

18
lib/lib_note_target.sh
View File

@@ -15,13 +15,13 @@
# Globals: # Globals:
# BASH_SOURCE # BASH_SOURCE
# SOURCE_DATE_EPOCH # SOURCE_DATE_EPOCH
# VAR_BASH_VER # VAR_VER_BASH
# VAR_DATE_INFO # VAR_DATE_INFO
# VAR_DS_VER # VAR_VER_DS
# VAR_GIT_REL # VAR_GIT_REL
# VAR_HANDLER_BUILD_DIR # VAR_HANDLER_BUILD_DIR
# VAR_HOST # VAR_HOST
# VAR_LB_VER # VAR_VER_LB
# VAR_VERSION # VAR_VERSION
# Arguments: # Arguments:
# None # None
@@ -43,9 +43,9 @@ note_target() {
Epoch : ${SOURCE_DATE_EPOCH} Epoch : ${SOURCE_DATE_EPOCH}
Date : ${VAR_DATE_INFO} Date : ${VAR_DATE_INFO}
Host : ${VAR_HOST} Host : ${VAR_HOST}
Bash : ${VAR_BASH_VER} Bash : ${VAR_VER_BASH}
Debootstrap : ${VAR_DS_VER} Debootstrap : ${VAR_VER_DS}
Live-Build : ${VAR_LB_VER} Live-Build : ${VAR_VER_LB}
This program is free software. Distribution and modification under This program is free software. Distribution and modification under
EUPL-1.2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK! EUPL-1.2 permitted. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
@@ -70,9 +70,9 @@ export CDLB_VERSION="${VAR_VERSION}"
export CDLB_GIT_REL="${VAR_GIT_REL}" export CDLB_GIT_REL="${VAR_GIT_REL}"
export CDLB_CR_DATE="${VAR_DATE_INFO}" export CDLB_CR_DATE="${VAR_DATE_INFO}"
export CDLB_CR_HOST="${VAR_HOST}" export CDLB_CR_HOST="${VAR_HOST}"
export CDLB_BASHVER="${VAR_BASH_VER}" export CDLB_BASHVER="${VAR_VER_BASH}"
export CDLB_DS_VER="${VAR_DS_VER}" export CDLB_DS_VER="${VAR_VER_DS}"
export CDLB_LB_VER="${VAR_LB_VER}" export CDLB_LB_VER="${VAR_VER_LB}"
export CDLB_SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH}" export CDLB_SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH}"
EOF EOF
chmod 0444 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/ciss-debian-live-builder.env" chmod 0444 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/ciss-debian-live-builder.env"

2
lib/lib_primordial.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Integrate primordial SSH identity files. # Integrate primordial SSH identity files.

2
lib/lib_provider_netcup.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Module for Netcup static IPv6 address. # Module for Netcup static IPv6 address.

2
lib/lib_run_analysis.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Wrapper for statistic functions of the final build. # Wrapper for statistic functions of the final build.

2
lib/lib_sanitizer.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Arguments check wrapper. # Arguments check wrapper.

95
lib/lib_trap_on_err.sh
View File

@@ -10,42 +10,50 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Print Error Message for Trap on 'ERR' in ${ERROR_LOG} # Print Error Message for Trap on 'ERR' in ${ERROR_LOG}
# Globals: # Globals:
# BASHOPTS
# EPOCHREALTIME
# ERRCMMD # ERRCMMD
# ERRCODE # ERRCODE
# ERRFUNC # ERRFUNC
# ERRLINE # ERRLINE
# ERRSCRT # ERRSCRT
# EUID
# LOG_DEBUG # LOG_DEBUG
# LOG_ERROR # LOG_ERROR
# LOG_VAR # LOG_VAR
# SECONDS # SECONDS
# SHELLOPTS
# UID
# VAR_ARG_SANITIZED # VAR_ARG_SANITIZED
# VAR_BASH_VER
# VAR_DS_VER
# VAR_EARLY_DEBUG # VAR_EARLY_DEBUG
# VAR_GIT_REL # VAR_GIT_REL
# VAR_LB_VER
# VAR_PARAM_COUNT # VAR_PARAM_COUNT
# VAR_PARAM_STRNG # VAR_PARAM_STRNG
# VAR_SYSTEM # VAR_SYSTEM
# VAR_VERSION # VAR_VERSION
# VAR_VER_BASH
# VAR_VER_DS
# VAR_VER_LB
# Arguments: # Arguments:
# None # None
####################################### #######################################
print_file_err() { print_file_err() {
{ {
printf "❌ CISS.debian.live.builder Script failed. \n" printf "❌ Trap on 'ERR' : CISS.debian.live.builder Script failed. \n"
printf "❌ Git Commit : %s \n" "${VAR_GIT_REL}" printf "❌ Git Commit : %s \n" "${VAR_GIT_REL}"
printf "❌ Version : %s \n" "${VAR_VERSION}" printf "❌ Version : %s \n" "${VAR_VERSION}"
printf "❌ Epoch : %s \n" "${EPOCHREALTIME}"
printf "❌ Bash : %s \n" "${VAR_VER_BASH}"
printf "❌ Live-Build : %s \n" "${VAR_VER_LB}"
printf "❌ Debootstrap : %s \n" "${VAR_VER_DS}"
printf "❌ UID : %s \n" "${UID}"
printf "❌ EUID : %s \n" "${EUID}"
printf "❌ Hostsystem : %s \n" "${VAR_SYSTEM}" printf "❌ Hostsystem : %s \n" "${VAR_SYSTEM}"
printf "❌ Bash : %s \n" "${VAR_BASH_VER}"
printf "❌ Live-Build : %s \n" "${VAR_LB_VER}"
printf "❌ Debootstrap : %s \n" "${VAR_DS_VER}"
printf "❌ Error : %s \n" "${ERRCODE}" printf "❌ Error : %s \n" "${ERRCODE}"
printf "❌ Line : %s \n" "${ERRLINE}" printf "❌ Line : %s \n" "${ERRLINE}"
printf "❌ Script : %s \n" "${ERRSCRT}" printf "❌ Script : %s \n" "${ERRSCRT}"
@@ -55,6 +63,8 @@ print_file_err() {
printf "❌ Arguments Counter : %s \n" "${VAR_PARAM_COUNT}" printf "❌ Arguments Counter : %s \n" "${VAR_PARAM_COUNT}"
printf "❌ Arguments Original : %s \n" "${VAR_PARAM_STRNG}" printf "❌ Arguments Original : %s \n" "${VAR_PARAM_STRNG}"
printf "❌ Arguments Sanitized : %s \n" "${VAR_ARG_SANITIZED}" printf "❌ Arguments Sanitized : %s \n" "${VAR_ARG_SANITIZED}"
printf "❌ Bashopts : %s \n" "${BASHOPTS}"
printf "❌ Shellopts : %s \n" "${SHELLOPTS}"
if "${VAR_EARLY_DEBUG}"; then if "${VAR_EARLY_DEBUG}"; then
@@ -72,7 +82,7 @@ print_file_err() {
readonly -f print_file_err readonly -f print_file_err
####################################### #######################################
# Print Error Message for Trap on 'ERR' on Terminal # Print Error Message for Trap on 'ERR' on Terminal.
# Globals: # Globals:
# ERRCMMD # ERRCMMD
# ERRCODE # ERRCODE
@@ -84,26 +94,29 @@ readonly -f print_file_err
# LOG_VAR # LOG_VAR
# SECONDS # SECONDS
# VAR_ARG_SANITIZED # VAR_ARG_SANITIZED
# VAR_BASH_VER
# VAR_DS_VER
# VAR_EARLY_DEBUG # VAR_EARLY_DEBUG
# VAR_GIT_REL # VAR_GIT_REL
# VAR_LB_VER
# VAR_PARAM_COUNT # VAR_PARAM_COUNT
# VAR_PARAM_STRNG # VAR_PARAM_STRNG
# VAR_SYSTEM # VAR_SYSTEM
# VAR_VERSION # VAR_VERSION
# VAR_VER_BASH
# VAR_VER_DS
# VAR_VER_LB
# Arguments: # Arguments:
# None # None
####################################### #######################################
print_scr_err() { print_scr_err() {
printf "\e[91m❌ CISS.debian.live.builder Script failed. \e[0m\n" >&2 printf "\e[91m❌ Trap on 'ERR' : CISS.debian.live.builder Script failed. \e[0m\n" >&2
printf "\e[91m❌ Git Commit : %s \e[0m\n" "${VAR_GIT_REL}" >&2 printf "\e[91m❌ Git Commit : %s \e[0m\n" "${VAR_GIT_REL}" >&2
printf "\e[91m❌ Version : %s \e[0m\n" "${VAR_VERSION}" >&2 printf "\e[91m❌ Version : %s \e[0m\n" "${VAR_VERSION}" >&2
printf "\e[91m❌ Epoch : %s \e[0m\n" "${EPOCHREALTIME}" >&2
printf "\e[91m❌ Bash : %s \e[0m\n" "${VAR_VER_BASH}" >&2
printf "\e[91m❌ Live-Build : %s \e[0m\n" "${VAR_VER_LB}" >&2
printf "\e[91m❌ Debootstrap : %s \e[0m\n" "${VAR_VER_DS}" >&2
printf "\e[91m❌ UID : %s \e[0m\n" "${UID}" >&2
printf "\e[91m❌ EUID : %s \e[0m\n" "${EUID}" >&2
printf "\e[91m❌ Hostsystem : %s \e[0m\n" "${VAR_SYSTEM}" >&2 printf "\e[91m❌ Hostsystem : %s \e[0m\n" "${VAR_SYSTEM}" >&2
printf "\e[91m❌ Bash : %s \e[0m\n" "${VAR_BASH_VER}" >&2
printf "\e[91m❌ Live-Build : %s \e[0m\n" "${VAR_LB_VER}" >&2
printf "\e[91m❌ Debootstrap : %s \e[0m\n" "${VAR_DS_VER}" >&2
printf "\e[91m❌ Error : %s \e[0m\n" "${ERRCODE}" >&2 printf "\e[91m❌ Error : %s \e[0m\n" "${ERRCODE}" >&2
printf "\e[91m❌ Line : %s \e[0m\n" "${ERRLINE}" >&2 printf "\e[91m❌ Line : %s \e[0m\n" "${ERRLINE}" >&2
printf "\e[91m❌ Script : %s \e[0m\n" "${ERRSCRT}" >&2 printf "\e[91m❌ Script : %s \e[0m\n" "${ERRSCRT}" >&2
@@ -113,6 +126,8 @@ print_scr_err() {
printf "\e[91m❌ Arguments Counter : %s \e[0m\n" "${VAR_PARAM_COUNT}" >&2 printf "\e[91m❌ Arguments Counter : %s \e[0m\n" "${VAR_PARAM_COUNT}" >&2
printf "\e[91m❌ Arguments Original : %s \e[0m\n" "${VAR_PARAM_STRNG}" >&2 printf "\e[91m❌ Arguments Original : %s \e[0m\n" "${VAR_PARAM_STRNG}" >&2
printf "\e[91m❌ Arguments Sanitized : %s \e[0m\n" "${VAR_ARG_SANITIZED}" >&2 printf "\e[91m❌ Arguments Sanitized : %s \e[0m\n" "${VAR_ARG_SANITIZED}" >&2
printf "\e[91m❌ Bashopts : %s \e[0m\n" "${BASHOPTS}" >&2
printf "\e[91m❌ Shellopts : %s \e[0m\n" "${SHELLOPTS}" >&2
printf "\e[91m❌ Error Log saved at : %s \e[0m\n" "${LOG_ERROR}" >&2 printf "\e[91m❌ Error Log saved at : %s \e[0m\n" "${LOG_ERROR}" >&2
printf "\e[91m❌ batcat --pager='less -r' %s \e[0m\n" "${LOG_ERROR}" >&2 printf "\e[91m❌ batcat --pager='less -r' %s \e[0m\n" "${LOG_ERROR}" >&2
@@ -124,7 +139,8 @@ print_scr_err() {
fi fi
printf "\n" print_stacktrace
printf "%b" "${NL}"
} }
### Prevents accidental 'unset -f'. ### Prevents accidental 'unset -f'.
# shellcheck disable=SC2034 # shellcheck disable=SC2034
@@ -216,4 +232,49 @@ dump_user_vars() {
### Prevents accidental 'unset -f'. ### Prevents accidental 'unset -f'.
# shellcheck disable=SC2034 # shellcheck disable=SC2034
readonly -f dump_user_vars readonly -f dump_user_vars
#######################################
# Print function() stacktrace.
# Globals:
# BASH_LINENO
# BASH_SOURCE
# FUNCNAME
# LINENO
# LOG_ERROR
# NL
# RED
# RES
# Arguments:
# None
#######################################
print_stacktrace() {
declare -i i=0
printf "%b❌ %b%b" "${RED}" "${RES}" "${NL}"
printf "❌ %b" "${NL}" >> "${LOG_ERROR}"
printf "%b❌ Raw Stacktrace : %b%b" "${RED}" "${RES}" "${NL}"
printf "❌ Raw Stacktrace : %b" "${NL}" >> "${LOG_ERROR}"
for ((i=0; i<${#FUNCNAME[@]}-1; i++)); do
if (( i == 0 )); then
printf "%b❌ ➥ %s() at: [%s:%s] %b%b" "${RED}" "${FUNCNAME[i]}" "${BASH_SOURCE[i]}" "${LINENO:-?}" "${RES}" "${NL}"
printf "❌ ➥ %s() at: [%s:%s] %b" "${FUNCNAME[i]}" "${BASH_SOURCE[i]}" "${LINENO:-?}" "${NL}" >> "${LOG_ERROR}"
else
printf "%b❌ ➥ %s() at: [%s:%s] %b%b" "${RED}" "${FUNCNAME[i]}" "${BASH_SOURCE[i]}" "${BASH_LINENO[i-1]:-?}" "${RES}" "${NL}"
printf "❌ ➥ %s() at: [%s:%s] %b" "${FUNCNAME[i]}" "${BASH_SOURCE[i]}" "${BASH_LINENO[i-1]:-?}" "${NL}" >> "${LOG_ERROR}"
fi
done
printf "%b" "${NL}"
}
### Prevents accidental 'unset -f'.
# shellcheck disable=SC2034
readonly -f print_stacktrace
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

139
lib/lib_trap_on_exit.sh
View File

@@ -10,33 +10,60 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
####################################### #######################################
# Trap function to be called on 'EXIT'. # Trap function to be called on 'EXIT'.
# Globals: # Globals:
# ERRCMMD
# ERRCODE
# ERRFUNC
# ERRLINE
# ERRSCRT
# ERRTRAP
# VAR_EARLY_DEBUG # VAR_EARLY_DEBUG
# Arguments: # Arguments:
# 1: $? # 1: $?
# 2: ${BASH_SOURCE[0]}
# 3: ${LINENO}
# 4: ${FUNCNAME[0]:-main}
# 5: ${BASH_COMMAND}
####################################### #######################################
trap_on_exit() { trap_on_exit() {
declare errcode="${ERRCODE:-$1}"
declare errscrt="${ERRSCRT:-$2}"
declare errline="${ERRLINE:-$3}"
declare errfunc="${ERRFUNC:-$4}"
declare errcmmd="${ERRCMMD:-$5}"
trap - DEBUG ERR EXIT INT TERM trap - DEBUG ERR EXIT INT TERM
declare -r var_trap_on_exit_code="$1" ### Defensive shell behavior inside trap.
set +e +o pipefail
if (( var_trap_on_exit_code == 0 )); then if (( errcode == 0 )); then
if "${VAR_EARLY_DEBUG}"; then dump_user_vars; fi if "${VAR_EARLY_DEBUG}"; then dump_user_vars; fi
clean_up "${var_trap_on_exit_code}" clean_up "${errcode}"
print_scr_exit "${var_trap_on_exit_code}" print_scr_exit "${errcode}"
exit "${var_trap_on_exit_code}" exit "${errcode}"
else else
exit "${var_trap_on_exit_code}" if [[ ! "${ERRTRAP}" == "true" ]]; then
if "${VAR_EARLY_DEBUG}"; then dump_user_vars; fi
clean_up "${errcode}"
print_scr_exit_non_zero "${errcode}" "${errscrt}" "${errline}" "${errfunc}" "${errcmmd}"
fi
exit "${errcode}"
fi fi
} }
@@ -45,22 +72,22 @@ trap_on_exit() {
readonly -f trap_on_exit readonly -f trap_on_exit
####################################### #######################################
# Print Success Message for Trap on 'EXIT' on 'stdout'. # Print success message for trap on 'EXIT' on 'stdout'.
# Globals: # Globals:
# LOG_DEBUG # LOG_DEBUG
# LOG_VAR # LOG_VAR
# SECONDS # SECONDS
# VAR_BASH_VER
# VAR_DS_VER
# VAR_EARLY_DEBUG # VAR_EARLY_DEBUG
# VAR_GIT_REL # VAR_GIT_REL
# VAR_HANDLER_BUILD_DIR # VAR_HANDLER_BUILD_DIR
# VAR_LB_VER
# VAR_SCRIPT_SUCCESS # VAR_SCRIPT_SUCCESS
# VAR_SYSTEM # VAR_SYSTEM
# VAR_VERSION # VAR_VERSION
# VAR_VER_BASH
# VAR_VER_DS
# VAR_VER_LB
# Arguments: # Arguments:
# 1: ${var_trap_on_exit_code} of trap_on_exit() # 1: ${errcode} of trap_on_exit()
####################################### #######################################
print_scr_exit() { print_scr_exit() {
declare -r var_print_scr_exit_code="$1" declare -r var_print_scr_exit_code="$1"
@@ -74,9 +101,9 @@ print_scr_exit() {
printf "\e[92m✅ Git Commit : %s \e[0m\n" "${VAR_GIT_REL}" printf "\e[92m✅ Git Commit : %s \e[0m\n" "${VAR_GIT_REL}"
printf "\e[92m✅ Version : %s \e[0m\n" "${VAR_VERSION}" printf "\e[92m✅ Version : %s \e[0m\n" "${VAR_VERSION}"
printf "\e[92m✅ Hostsystem : %s \e[0m\n" "${VAR_SYSTEM}" printf "\e[92m✅ Hostsystem : %s \e[0m\n" "${VAR_SYSTEM}"
printf "\e[92m✅ Bash : %s \e[0m\n" "${VAR_BASH_VER}" printf "\e[92m✅ Bash : %s \e[0m\n" "${VAR_VER_BASH}"
printf "\e[92m✅ Live-Build : %s \e[0m\n" "${VAR_LB_VER}" printf "\e[92m✅ Live-Build : %s \e[0m\n" "${VAR_VER_LB}"
printf "\e[92m✅ Debootstrap : %s \e[0m\n" "${VAR_DS_VER}" printf "\e[92m✅ Debootstrap : %s \e[0m\n" "${VAR_VER_DS}"
printf "\e[92m✅ Aide Initial DB at : %s \e[0m\n" "${VAR_HANDLER_BUILD_DIR}/.integrity/" printf "\e[92m✅ Aide Initial DB at : %s \e[0m\n" "${VAR_HANDLER_BUILD_DIR}/.integrity/"
printf "\e[92m✅ Exited with Status : %s \e[0m\n" "${var_print_scr_exit_code}" printf "\e[92m✅ Exited with Status : %s \e[0m\n" "${var_print_scr_exit_code}"
printf "\n" printf "\n"
@@ -102,4 +129,86 @@ print_scr_exit() {
### Prevents accidental 'unset -f'. ### Prevents accidental 'unset -f'.
# shellcheck disable=SC2034 # shellcheck disable=SC2034
readonly -f print_scr_exit readonly -f print_scr_exit
#######################################
# Trap on 'EXIT' handler for 'non-0' exit-code.
# Globals:
# BASHOPTS
# EPOCHREALTIME
# ERRCMMD
# ERRCODE
# ERRFUNC
# ERRLINE
# ERRSCRT
# EUID
# LOG_DEBUG
# LOG_ERROR
# LOG_VAR
# NL
# SECONDS
# SHELLOPTS
# UID
# VAR_ARG_SANITIZED
# VAR_EARLY_DEBUG
# VAR_GIT_REL
# VAR_PARAM_COUNT
# VAR_PARAM_STRNG
# VAR_SYSTEM
# VAR_VERSION
# VAR_VER_BASH
# VAR_VER_DS
# VAR_VER_LB
# Arguments:
# 1: $?
# 2: ${BASH_SOURCE[0]}
# 3: ${LINENO}
# 4: ${FUNCNAME[0]:-main}
# 5: ${BASH_COMMAND}
#######################################
print_scr_exit_non_zero() {
declare errcode="${ERRCODE:-$1}"
declare errscrt="${ERRSCRT:-$2}"
declare errline="${ERRLINE:-$3}"
declare errfunc="${ERRFUNC:-$4}"
declare errcmmd="${ERRCMMD:-$5}"
printf "\e[91m❌ Trap on 'EXIT' : CISS.debian.live.builder Script failed. \e[0m\n" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ : This was most probably caused by an unbound variable. \e[0m\n" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Git Commit : %s \e[0m\n" "${VAR_GIT_REL}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Version : %s \e[0m\n" "${VAR_VERSION}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Epoch : %s \e[0m\n" "${EPOCHREALTIME}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Bash : %s \e[0m\n" "${VAR_VER_BASH}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Live-Build : %s \e[0m\n" "${VAR_VER_LB}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Debootstrap : %s \e[0m\n" "${VAR_VER_DS}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ UID : %s \e[0m\n" "${UID}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ EUID : %s \e[0m\n" "${EUID}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Hostsystem : %s \e[0m\n" "${VAR_SYSTEM}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Error : %s \e[0m\n" "${errcode}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Line : %s \e[0m\n" "${errline}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Script : %s \e[0m\n" "${errscrt}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Function : %s \e[0m\n" "${errfunc}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Command : %s \e[0m\n" "${errcmmd}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Script Runtime : %s \e[0m\n" "${SECONDS}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Arguments Counter : %s \e[0m\n" "${VAR_PARAM_COUNT}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Arguments Original : %s \e[0m\n" "${VAR_PARAM_STRNG}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Arguments Sanitized : %s \e[0m\n" "${VAR_ARG_SANITIZED}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Bashopts : %s \e[0m\n" "${BASHOPTS}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Shellopts : %s \e[0m\n" "${SHELLOPTS}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Error Log saved at : %s \e[0m\n" "${LOG_ERROR}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ batcat --pager='less -r' %s \e[0m\n" "${LOG_ERROR}" | tee -a "${LOG_ERROR}"
if "${VAR_EARLY_DEBUG}"; then
printf "\e[91m❌ Vars Dump saved at : %s \e[0m\n" "${LOG_VAR}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ Debug Log saved at : %s \e[0m\n" "${LOG_DEBUG}" | tee -a "${LOG_ERROR}"
printf "\e[91m❌ batcat --pager='less -r' %s \e[0m\n" "${LOG_DEBUG}" | tee -a "${LOG_ERROR}"
fi
print_stacktrace
printf "%b" "${NL}"
}
### Prevents accidental 'unset -f'.
# shellcheck disable=SC2034
readonly -f print_scr_exit_non_zero
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

4
lib/lib_usage.sh
View File

@@ -39,13 +39,13 @@ usage() {
# shellcheck disable=SC2155 # shellcheck disable=SC2155
declare var_header=$(center "CDLB(1) CISS.debian.live.builder CDLB(1)" "${var_cols}") declare var_header=$(center "CDLB(1) CISS.debian.live.builder CDLB(1)" "${var_cols}")
# shellcheck disable=SC2155 # shellcheck disable=SC2155
declare var_footer=$(center "V8.13.384.2025.11.06 2025-11-06 CDLB(1)" "${var_cols}") declare var_footer=$(center "V8.13.392.2025.11.07 2025-11-06 CDLB(1)" "${var_cols}")
{ {
echo -e "\e[1;97m${var_header}\e[0m" echo -e "\e[1;97m${var_header}\e[0m"
echo echo
echo -e "\e[92mCISS.debian.live.builder from https://git.coresecret.dev/msw \e[0m" echo -e "\e[92mCISS.debian.live.builder from https://git.coresecret.dev/msw \e[0m"
echo -e "\e[92mMaster V8.13.384.2025.11.06\e[0m" echo -e "\e[92mMaster V8.13.392.2025.11.07\e[0m"
echo -e "\e[92mA lightweight Shell Wrapper for building a hardened Debian Live ISO Image.\e[0m" echo -e "\e[92mA lightweight Shell Wrapper for building a hardened Debian Live ISO Image.\e[0m"
echo echo
echo -e "\e[97m(c) Marc S. Weidner, 2018 - 2025 \e[0m" echo -e "\e[97m(c) Marc S. Weidner, 2018 - 2025 \e[0m"

4
lib/lib_version.sh
View File

@@ -13,7 +13,7 @@
####################################### #######################################
# Version module 'CISS.debian.live.builder'. # Version module 'CISS.debian.live.builder'.
# Globals: # Globals:
# VAR_BASH_VER # VAR_VER_BASH
# VAR_GIT_REL # VAR_GIT_REL
# VAR_HOST # VAR_HOST
# VAR_VERSION # VAR_VERSION
@@ -43,7 +43,7 @@ $(echo -e "\e[97m###############################################################
Using : lb (${VAR_VER_LB}) debootstrap (${VAR_VER_DS}) Using : lb (${VAR_VER_LB}) debootstrap (${VAR_VER_DS})
on : ${VAR_HOST} on : ${VAR_HOST}
Bash : ${VAR_BASH_VER} Bash : ${VAR_VER_BASH}
EOF EOF

4
scripts/usr/local/sbin/9999-cdi-starter
View File

@@ -127,7 +127,7 @@ main() {
# shellcheck disable=SC2312 # shellcheck disable=SC2312
exec > >(tee -a "${var_log}") 2>&1 exec > >(tee -a "${var_log}") 2>&1
printf "CISS.debian.installer Master V8.13.384.2025.11.06 is up! \n" >> "${var_log}" printf "CISS.debian.installer Master V8.13.392.2025.11.07 is up! \n" >> "${var_log}"
### Sleep a moment to settle boot artifacts. ### Sleep a moment to settle boot artifacts.
sleep 8 sleep 8
@@ -182,7 +182,7 @@ main() {
### Timeout reached without acceptable semaphore. ### Timeout reached without acceptable semaphore.
logger -t cdi-watcher "No valid semaphore ${VAR_SEMAPHORE} (mode 0600) within ${VAR_TIMEOUT}s; exiting idle." logger -t cdi-watcher "No valid semaphore ${VAR_SEMAPHORE} (mode 0600) within ${VAR_TIMEOUT}s; exiting idle."
printf "CISS.debian.installer Master V8.13.384.2025.11.06: No valid semaphore [%s] within [%s]s.\n" "${VAR_SEMAPHORE}" "${VAR_TIMEOUT}" >> "${var_log}" printf "CISS.debian.installer Master V8.13.392.2025.11.07: No valid semaphore [%s] within [%s]s.\n" "${VAR_SEMAPHORE}" "${VAR_TIMEOUT}" >> "${var_log}"
exit 0 exit 0
} }

2
var/bash.var.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
### For all options see https://www.gnu.org/software/bash/manual/bash.html#The-Set-Builtin ### For all options see https://www.gnu.org/software/bash/manual/bash.html#The-Set-Builtin
set -o errexit # Exit script when a command exits with non-zero status, the same as "set -e". set -o errexit # Exit script when a command exits with non-zero status, the same as "set -e".

2
var/color.var.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
### Definition of color variables. ### Definition of color variables.

17
var/early.var.sh
View File

@@ -13,14 +13,6 @@
### Definition of MUST set early variables. ### Definition of MUST set early variables.
# shellcheck disable=SC2155 # shellcheck disable=SC2155
declare -grx VAR_BASH_VER="$(bash --version | head -n1 | awk '{
# Print $4 and $5; include $6 only if it exists
out = $4
if (NF >= 5) out = out " " $5
if (NF >= 6) out = out " " $6
print out
}')"
declare -grx VAR_CONTACT="security@coresecret.eu" declare -grx VAR_CONTACT="security@coresecret.eu"
declare -grx VAR_DATE="$(date +%F)" declare -grx VAR_DATE="$(date +%F)"
declare -grx VAR_DATE_EPOCH="$(date -u +%s)" declare -grx VAR_DATE_EPOCH="$(date -u +%s)"
@@ -33,7 +25,14 @@ declare -grx VAR_GIT_HEAD_FULL="$(git rev-parse HEAD)"
declare -grx VAR_HOST="$(uname -n)" declare -grx VAR_HOST="$(uname -n)"
declare -grx VAR_ISO8601="$(date -u -d "@${VAR_DATE_EPOCH}" '+%Y-%m-%dT%H:%M:%SZ')" declare -grx VAR_ISO8601="$(date -u -d "@${VAR_DATE_EPOCH}" '+%Y-%m-%dT%H:%M:%SZ')"
declare -grx VAR_SYSTEM="$(uname -mnosv)" declare -grx VAR_SYSTEM="$(uname -mnosv)"
declare -grx VAR_VERSION="Master V8.13.384.2025.11.06" declare -grx VAR_VERSION="Master V8.13.392.2025.11.07"
declare -grx VAR_VER_BASH="$(bash --version | head -n1 | awk '{
# Print $4 and $5; include $6 only if it exists
out = $4
if (NF >= 5) out = out " " $5
if (NF >= 6) out = out " " $6
print out
}')"
declare -grx VAR_VER_DS="$(debootstrap --version)" declare -grx VAR_VER_DS="$(debootstrap --version)"
declare -grx VAR_VER_LB="$(lb -v)" declare -grx VAR_VER_LB="$(lb -v)"
declare -gx APT_LISTCHANGES_FRONTEND="none" declare -gx APT_LISTCHANGES_FRONTEND="none"

19
var/global.var.sh
View File

@@ -11,7 +11,7 @@
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
# shellcheck disable=SC2155,SC2034 # shellcheck disable=SC2155,SC2034
guard_sourcing guard_sourcing || return "${ERR_GUARD_SRCE}"
### Definition of MUST set global variables. ### Definition of MUST set global variables.
declare -gr VAR_KERNEL_INF="$(mktemp)" declare -gr VAR_KERNEL_INF="$(mktemp)"
@@ -55,11 +55,26 @@ declare -gx VAR_SIGNING_KEY_PASS=""
declare -gx VAR_SIGNING_KEY_PASSFILE="" declare -gx VAR_SIGNING_KEY_PASSFILE=""
declare -gx VAR_SIGNING_KEY="" declare -gx VAR_SIGNING_KEY=""
### Definition of error codes ### Definition of color variables.
declare -grx BLA='\e[90m' # Beautiful black for the techno fans.
declare -grx RED='\e[91m' # Bright red.
declare -grx GRE='\e[92m' # Vibrant green.
declare -grx YEL='\e[93m' # Fancy yellow
declare -grx BLU='\e[94m' # Organic blue.
declare -grx MAG='\e[95m' # Super gay magenta.
declare -grx CYA='\e[96m' # Lovely cyan.
declare -grx WHI='\e[97m' # Fantastic color mix.
declare -grx RES='\e[0m' # Forget everything.
declare -grx TAB='\t' # Insert a fresh tabulator.
declare -grx NL='\n' # Print a crystal clear new line.
### Definition of error codes.
declare -gir ERR_UNCRITICAL=127 declare -gir ERR_UNCRITICAL=127
declare -gir ERR_NOT_USER_0=128 # Not running as root declare -gir ERR_NOT_USER_0=128 # Not running as root
declare -gir ERR_FLOCK_WRTG=129 # Cannot open lockfile for writing declare -gir ERR_FLOCK_WRTG=129 # Cannot open lockfile for writing
declare -gir ERR_FLOCK_COLL=130 # The Script is already running declare -gir ERR_FLOCK_COLL=130 # The Script is already running
declare -gir ERR_GUARD_SRCE=131 # Module tried to load twice.
declare -gir ERR_GPG__AGENT=132 # GNUPG agent error.
declare -gir ERR_SPLASH_PNG=200 # --change-splash MUST be 'club' or 'hexagon' declare -gir ERR_SPLASH_PNG=200 # --change-splash MUST be 'club' or 'hexagon'
declare -gir ERR_CONTROL_CT=201 # --control MUST be an integer between '1' and '65535' declare -gir ERR_CONTROL_CT=201 # --control MUST be an integer between '1' and '65535'
declare -gir ERR_RENICE_PRI=202 # --renice-priority MUST an integer between '-19' and '19' declare -gir ERR_RENICE_PRI=202 # --renice-priority MUST an integer between '-19' and '19'